Impact of Deleting a Custom Identity Attribute

Identity Security Cloud (ISC) ISC Discussion and Questions
1

Does anyone know when this went into effect?

Impact of Deleting a Custom Identity Attribute

Deleting a custom identity attribute may have unintended consequences.

  • Deleting a custom attribute from an identity profile deletes the attribute from all identity profiles, not just the identity profile you are editing.You must individually run identity processing on each identity profile in the Identity Profiles list. This is required even if the attribute is not mapped in the identity profile.
  • Deleting the attribute could cause data integrity issues if it’s used in other areas of your tenant, such as:
    • Roles whose membership criteria are based on the value of this attribute.
    • The Identity Security Cloud User Name field if it has been configured to use this attribute.
    • A custom app’s User Name field if it has been configured to use this attribute.
    • SAML attributes including the attribute maps. Refer to SAML Configuration Guide​ for details.
    • Rules or transforms that call this attribute in the related code.This can include calculations to determine:
    • Lifecycle states which could impact provisioning.
    • Exclusion rules which could impact certifications
2

Hi Nathaniel,
It will effect on next identity processing which may happen either through event-based or schedule based or manual processing.

3

I’m more after when did this behavior become what happens?

Previously I could create an identity profile with a different number of attributes and that was fine. Now all identity profiles get the number of attributes equal to the newest created / imported identity profile.

4

All profiles get all identity attributes (at least for the last 3 years). They won’t show up on the user’s cube unless you assign a value or transform to it on the profile window

1 Like
5

Yes, you are correct and it is been here for a long time now but couldn’t remember when it got changed.

6

That’s the case if I query the identity profile via API (any version), but the GUI presents a different picture. I have an API showing all the attributes I would expect, but the GUI shows a very limited list that is matching to the identity profile with the fewest number of attributes. When identities process, what is shown in the GUI is what happens and all kinds of attributes are not populated.

Is there a way to see which attributes are masked from appearing in the GUI?

7

The only reasons that an attribute is not populated (or masked) is that:

  • its either unassigned with a static value
  • the source value that its assigned to is empty
  • the assigned transform is producing a valid ‘null’ result

I don’t know if you can script a view of that

9

It’s not that the attribute isn’t populated it’s that it’s not a part of the identity profile. Documentation would seem to suggest there is no way to have identity profiles with a different number of attributes on them and yet we’ve had several until what looks like some time in the last several months suddenly all them are the same. I don’t know if we’ve been existing with a bug that just got “fixed” or if there is some other condition whereby, we were able to have identity profiles with different number of attributes and now are not.

When I went back through our config hub backups as recently as September of last year our identity profiles had different numbers of attributes and were all working just fine.

10

That’s very bizarre. Might be a question for Sailpoint directly.
Sorry I can’t be of any more help

11

In your JSON representations, the identity attributes might not be there as part of the Identity Profile. However, the identity attributes are most definitely in the tenant, and therefore any identity profile will be considered ‘impacted’ when you delete an identity attribute from the profile.

In other words, any identity attribute that you do not use in an identity profile is considered to have a ‘null’ configuration and is omitted from any JSON export you do (config hub, sp-config, identity-profile API). However, from the UI the attribute will be visible.

12

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.